Many modern web applications are implemented using the Java Enterprise Edition (JavaEE) platform. These types of web applications often make use of Expression Language (EL) expressions and tag libraries when presenting content via Java Server Pages (JSPs). This use of EL expressions and tag libraries makes traditional static analysis of such applications generally ineffective. For example, EL expression evaluation and tag libraries are often implemented using Java reflection and complex string manipulation, both of which cause significant difficulties for conventional static analysis engines. One key difficulty is that the execution of certain tag library calls can bind new names, which are then accessed by later EL expressions. This name-binding behavior of a tag library cannot easily be determined by analyzing its implementation.